OpenAI Flags macOS App Security Issue, Urges Immediate Updates
OpenAI advises Mac users to update apps urgently after a signing flaw, assuring no data breach but enforcing stricter security measures.
OpenAI has issued an important advisory for macOS users, urging them to update several of its desktop applications after identifying a security vulnerability linked to its app-signing process. The company emphasized that while the issue is serious, there is no evidence of user data exposure, system compromise, or software tampering.
The problem traces back to March 31, 2026, when a widely used developer library, Axios, was compromised in what has been described as a software supply chain attack. During this period, a GitHub Actions workflow used by OpenAI for signing macOS applications inadvertently downloaded a malicious version of the library.
This workflow had access to sensitive code-signing and notarisation credentials used to verify the authenticity of OpenAI’s macOS applications, including ChatGPT Desktop, Codex, Codex CLI, and Atlas. Although OpenAI noted that multiple safeguards were in place and its analysis suggests the certificate was likely not exfiltrated, the company is treating the situation with caution and considering the certificate potentially compromised.
As a result, OpenAI is rotating its security certificates and requiring users to upgrade to the latest versions of its Mac applications. Users can perform updates directly through the apps or by downloading the latest versions from official OpenAI sources.
To further protect users, the company has warned against installing its applications from third-party platforms. It specifically advised avoiding links received via emails, messages, or advertisements, as these could be used to distribute fake or malicious software.
OpenAI also announced a firm deadline: starting May 8, 2026, older versions of its macOS applications will no longer be supported and may stop functioning altogether. The minimum supported versions after this date include ChatGPT Desktop version 1.2026.051, Codex App version 26.406.40811, Codex CLI version 0.119.0, and Atlas version 1.2026.84.2.
Once the older certificate is fully revoked, macOS security mechanisms will automatically block any attempts to launch or install applications signed with the outdated credentials. This step is part of broader efforts to ensure platform integrity and prevent misuse.
Despite the incident, OpenAI reassured users that no passwords, API keys, or personal data were compromised. The company also clarified that the issue is limited strictly to macOS applications and does not affect its services on iOS, Android, Windows, Linux, or web platforms.
In response, OpenAI has already released updated application builds with new certificates, conducted a review of past software notarisation activities, and is working closely with Apple to prevent any further misuse of the old certificate.
The advisory underscores the growing risks associated with software supply chain attacks and highlights the importance of keeping applications updated to maintain security.
